System and methods for secure firmware validation

ABSTRACT

An electronic device, such as a dynamic transaction card having a chip, an applet, and a cryptographic coprocessor performs secure firmware and/or software updates, and performs firmware and/or software validation for firmware and/or software that is stored on the electronic device. Validation may compare a calculated checksum with a checksum stored in the device. If a checksum calculated for a firmware and/or a software application matches a stored checksum, the transaction card may operate normally. If a checksum calculated for a firmware and/or a software application does not match the stored checksum, the transaction card may freeze all capabilities, erase the memory of the transaction card, display data indicative of fraud, and/or the like.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of, and claims priority under 35U.S.C. § 120 to, U.S. patent application Ser. No. 16/591,663, filed Oct.3, 2019, which is a continuation of U.S. patent application Ser. No.15/944,741, now U.S. Pat. No. 10,509,908, filed Apr. 3, 2018, which is acontinuation of U.S. patent application Ser. No. 15/099,048, now U.S.Pat. No. 9,965,632, filed Apr. 14, 2016, which claims the benefit ofU.S. Provisional Application No. 62/305,850, entitled “Systems andMethods for Secure Firmware Updates,” filed Mar. 9, 2016, U.S.Provisional Application No. 62/270,465, entitled “Device, System, Methodfor Firmware Validation,” filed Dec. 21, 2015, and U.S. ProvisionalApplication No. 62/147,568, entitled “A System, Method, and Apparatusfor a Dynamic Transaction Card,” filed Apr. 14, 2015. The entirecontents of these applications are fully incorporated herein byreference.

This application is related to U.S. application Ser. No. 15/098,903,entitled “Tamper-Resistant Transaction Card and Method of Providing aTamper-Resistant Transaction Card,” filed Apr. 14, 2016, which claimsthe benefit of U.S. Provisional Application No. 62/270,449, filed Dec.21, 2015; U.S. application Ser. No. 15/098,935, entitled “DynamicTransaction Card Power Management,” filed Apr. 14, 2016, which claimsthe benefit of U.S. Provisional Application No. 62/266,324, filed Dec.11, 2015, U.S. Provisional Application No. 62/270,307, filed Dec. 21,2015, and U.S. Provisional Application No. 62/305,599, filed Mar. 9,2016; and U.S. application Ser. No. 14/977,730, entitled “System,Method, and Apparatus for Locating a Bluetooth Enabled TransactionCard,” filed Dec. 22, 2015, which claims the benefit of U.S. ProvisionalApplication No. 62/095,190, filed Dec. 22, 2014. The entire contents ofthese applications are incorporated herein by reference.

FIELD OF THE DISCLOSURE

The present disclosure relates to systems and methods that securelyupdate firmware and/or software on an electronic device, such as adynamic transaction card that may utilize an EMV chip as a TrustedPlatform Module (TPM) in order to store and calculate checksums forfirmware and/or application validation.

BACKGROUND OF THE DISCLOSURE

Updating firmware and/or software on an electronic device such as adynamic transaction card may introduce potential security issues, suchas the insertion of malware, spyware, and/or the like. Standardover-the-air (OTA) updates are not secure enough to ensure that malware,spyware, and/or the like are not introduced during the update.

A checksum may be used for firmware and/or software validation. However,currently when a checksum is used for software validation, the checksumstorage and validation occur using the same device component (e.g., amicroprocessor, microcontroller, and the like) making the checksums usedfor validation susceptible to security threats. Moreover, currentchecksum calculations typically use predefined intervals or times to runsuch as at boot-up, device wakeup, and/or a network connection.

These and other drawbacks exist.

SUMMARY OF THE DISCLOSURE

Various embodiments of the present disclosure provide systems andmethods that securely update firmware and/or software on an electronicdevice, such as a dynamic transaction card including anEuroPay-MasterCard-Visa (EMV) microcontroller chip. An EMV chip may beused as a Trusted Platform Module (TPM) in order to store and calculatechecksums for associated firmware and/or software validation.

As referred to herein, an EMV chip may be a secure cryptographiccoprocessor such as a TPM. An EMV chip may be secured within atransaction card, such as dynamic transaction card disclosed in U.S.Provisional Application No. 62/147,568, the entire contents of which areincorporated herein. For example, an EMV chip may be a read-onlymicroprocessor.

In the various embodiments described herein, a secure update of firmwareand/or software stored on an electronic device, such as a dynamictransaction card including an EMV chip may include connecting theelectronic device with a firmware/software provider system via a secureterminal connection. Once the dynamic transaction card and the POSterminal/ATM/stand-alone secure terminal have established a secureconnection, the POS terminal/ATM/stand-alone secure terminal maytransmit at least a portion of a firmware and/or software update via thesecure connection from a backend system (e.g., a financial institutionsystem and/or other dynamic transaction card firmware and/or softwareprovider system) to the dynamic transaction card.

A transmission of at least a portion of a firmware and/or softwareupdate may occur during and/or at the end of a transaction, such as anEMV transaction. In this manner, the backend system (e.g., a financialinstitution system and/or other dynamic transaction card firmware and/orsoftware provider system) that is involved in the transaction maytransmit the firmware and/or software update portion in secure packetssuch as transaction tokens. A portion of a firmware and/or softwareupdate may include the entire updated firmware and/or software program,a section of the updated firmware and/or software program, acryptographic key to decrypt a firmware and/or software update, and/or achecksum associated with the updated firmware and/or software program.

A bootloader on the dynamic transaction card may receive a boot signalfrom a device, such as a the secure terminal and/or a user device, usethe bootloader signal to validate the bootloader and determine whetherthe existing firmware and/or software is valid, load the updatedfirmware and/or software program, and execute the updated firmwareand/or software program, which overwrites the existing firmware and/orsoftware.

If the at least a portion of the firmware and/or software update is notthe entire updated firmware and/or software program, the remainingportion of the firmware and/or software update may be downloaded from auser device, such as a smart phone, tablet, computer, and/or the like,via a network, such as a Bluetooth, Bluetooth Low Energy (BLE), NearField Communication (NFC), WiFi, and/or other wireless network thatenables a connection between the transaction card and user device. Theremaining portion of the firmware and/or software update also may bedownloaded from a user device via a physical connection between the userdevice and the dynamic transaction card, such as using a portable EMVreader attached to the user device.

If the remaining portion of the firmware and/or software updatedownloaded from a user device is encrypted, the dynamic transaction cardmay decrypt it. For example, the portion of the firmware and/or softwareupdate received from the secure terminal may include a key (e.g., aprivate key, a public key, and/or the like) to decrypt the remainingportion received from a user device. An EMV processor may also includepre-stored keys (e.g., private keys, public keys, and/or the like) thatmay be used to decrypt the remaining portion of a firmware and/orsoftware update received from a user device.

If the remaining portion of the firmware and/or software updatedownloaded from a user device includes a checksum associated with thefirmware and/or software update, this checksum may be used to verify thefirmware and/or software update. For example, a checksum may becalculated for the total updated firmware and/or software programreceived on the dynamic transaction card. The received checksum may thenbe compared with the calculated checksum. And, if the received checksumis equal to the calculated checksum, the updated firmware and/orsoftware program may be considered validated. If the received checksumis not equal to the calculated checksum, the dynamic transaction cardmay transmit an alert to the firmware and/or software provider. Thisalert may trigger a backend action such as a deactivation of the dynamictransaction card, a hold on the dynamic transaction card, thetransmission of a message to a user device and/or the dynamictransaction card (via the user device and/or a terminal), and/or loggingthe backend action in response to the alert.

A checksum may be calculated for each software program being loaded ontoa transaction card at a personalization phase of the card. Apersonalization phase may include card manufacturer loading of softwareonto a transaction card and/or software development loading of softwareonto transaction card. A personalisation phase may include a loading ofsoftware programming onto an EMV chip to be included in a transactioncard. A checksum may be transmitted to the EMV chip where the checksummay be stored. A checksum may be calculated and transmitted for eachsoftware program to be loaded onto a transaction card. A checksum may becalculated by each software application loaded onto a transaction card.For example, a checksum may be calculated for firmware loaded onto atransaction card.

In order to calculate checksums, an EMV processor may be used. Forexample, an EMV processor may be secured within a dynamic transactioncard. An EMV processor may be a read-only microprocessor. An EMVprocessor may include a cryptographic coprocessor. An EMV processor mayinclude a customer Applet to perform checksum calculations, comparecalculated checksums, and/or determined when to perform checksumcalculations. An EMV processor may also communicate via conductiveplastic jumpers, such as the plastic jumpers disclosed in U.S.Provisional Application No. 62/270,449, the entire contents of which areincorporated herein.

Once an update is validated, a bootloader on the dynamic transactioncard may receive a boot signal from a device, such as a the secureterminal and/or a user device, use the bootloader signal to validate thebootloader and determine whether the existing firmware and/or softwareis valid, load the updated firmware and/or software program, and executethe updated firmware and/or software program, which overwrites theexisting firmware and/or software.

A status of the update procedure may be logged on the dynamictransaction card, a user device (once the status is transmitted from thedynamic transaction card to the user device), and/or a backend systemvia a user device connection (e.g., financial institution,firmware/software provider system, and/or the like).

BRIEF DESCRIPTION OF THE DRAWINGS

Various embodiments of the present disclosure, together with furtherobjects and advantages, may best be understood by reference to thefollowing description taken in conjunction with the accompanyingdrawings, in the several Figures of which like reference numeralsidentify like elements, and in which:

FIG. 1 depicts an example system that securely update firmware and/orsoftware on an electronic device, according to embodiments of thedisclosure;

FIG. 2 depicts an example dynamic transaction card that receives andprocesses secure firmware and/or software updates, according toembodiments of the disclosure;

FIG. 3 depicts an example dynamic transaction card that receives andprocesses secure firmware and/or software updates, according toembodiments of the disclosure;

FIG. 4 depicts an example secure terminal used in dynamic transactioncard secure firmware and/or software updates, according to embodimentsof the disclosure;

FIG. 5 depicts an example system component for securely updatingfirmware and/or software on an electronic device, according toembodiments of the disclosure;

FIG. 6 depicts an example method for securely updating firmware and/orsoftware on an electronic device, according to embodiments of thedisclosure;

FIG. 7 depicts an example method using an EMV chip as a TPM in order tostore and calculate checksums for firmware and/or applicationvalidation, according to embodiments of the disclosure; and

FIG. 8 depicts an example device with an EMV chip as a TPM in order tostore and calculate checksums for firmware and/or applicationvalidation, according to embodiments of the disclosure.

DETAILED DESCRIPTION OF THE EMBODIMENTS

The following description is intended to convey a thorough understandingof the embodiments described by providing a number of specific exampleembodiments and details involving systems, methods, and devices used insecurely updating firmware and/or software on an electronic device, suchas a dynamic transaction card, according to embodiments of thedisclosure. An EMV chip may be used as a ‘TPM in order to store andcalculate checksums for firmware and/or application validation,according to embodiments of the disclosure. It should be appreciated,however, that the present disclosure is not limited to these specificembodiments and details, which are examples only. It is furtherunderstood that one possessing ordinary skill in the art, in light ofknown systems and methods, would appreciate the use of the invention forits intended purposes and benefits in any number of alternativeembodiments, depending on specific design and other needs.

A dynamic transaction card as a device with an EMV processor thatsecurely receives and processes firmware and/or software updates is usedas an example for the disclosure. The disclosure is not intended to belimited to dynamic transaction cards only. For example, many other smallelectronic devices may incorporate an EMV processor may securely receiveand process firmware and/or software updates according to theembodiments disclosed herein.

Additionally, the use of “mobile device” in the examples throughout thisapplication is only by way of example. Any type of device capable ofcommunicating with a transaction card or a backend system may also beused, including, for example, Automated Teller Machines (ATM) personalcomputers, tablets, gaming systems, televisions, or the like.

FIG. 1 depicts an example system 100 including a dynamic transactioncard 120 such as a dynamic transaction card, as described herein, havinga secure element, such as an EMV processor, which may be used as a TPM,that may be used to securely update the dynamic transaction card 120. Asshown in FIG. 1, an example system 100 may include one or more dynamictransaction cards 120, one or more firmware/software provider systems130, one or more mobile devices 140, and one or more third partyterminals 150 connected over one or more networks 110.

For example, network 110 may be one or more of a wireless network, awired network or any combination of wireless network and wired network.For example, network 110 may include one or more of a fiber opticsnetwork, a passive optical network, a cable network, an Internetnetwork, a satellite network, a wireless LAN, a Global System for MobileCommunication (“GSM”), a Personal Communication Service (“PCS”), aPersonal Area Network (“PAN”), Wireless Application Protocol (WAP),Multimedia Messaging Service (MMS), Enhanced Messaging Service (EMS),Short Message Service (SMS), Time Division Multiplexing (TDM) basedsystems, Code Division Multiple Access (CDMA) based systems, D-AMPS,Wi-Fi, Fixed Wireless Data, IEEE 802.11b, 802.15.1, 802.11n and 802.11g,a Bluetooth network, or any other wired or wireless network fortransmitting and receiving a data signal.

In addition, network 110 may include, without limitation, telephonelines, fiber optics, IEEE Ethernet 902.3, a wide area network (“WAN”), alocal area network (“LAN”), a wireless personal area network (“WPAN”),or a global network such as the Internet. Also network 110 may supportan Internet network, a wireless communication network, a cellularnetwork, or the like, or any combination thereof. Network 110 mayfurther include one network, or any number of the example types ofnetworks mentioned above, operating as a stand-alone network or incooperation with each other. Network 110 may utilize one or moreprotocols of one or more network elements to which they arecommunicatively coupled. Network 110 may translate to or from otherprotocols to one or more protocols of network devices. Although network110 is depicted as a single network, it should be appreciated thataccording to one or more embodiments, network 110 may comprise aplurality of interconnected networks, such as, for example, theInternet, a service provider's network, a cable television network,corporate networks, and home networks.

Dynamic transaction card 120, firmware/software provider system 130,mobile device 140 and/or third party terminal 150 may include, forexample, one or more mobile devices, such as, for example, personaldigital assistants (PDA), tablet computers, smart watches, and/orelectronic readers (e.g., iPad, Kindle Fire, Playbook, Touchpad, etc.),wearable devices (e.g., Google Glass), telephony devices, smartphones,cameras, music playing devices (e.g., iPod, etc.), televisions,set-top-box devices, and the like.

Dynamic transaction card 120 (e.g., a dynamic transaction card asdescribed herein), firmware/software provider system 130, mobile device140 and/or third party system 150 (e.g., a third party terminal asdescribed herein) also may include a network-enabled computer systemand/or device. As referred to herein, a network-enabled computer systemand/or device may include, but is not limited to: e.g., any computerdevice, or communications device including, e.g., a server, a networkappliance, a personal computer (PC), a workstation, a mobile device, aphone, a handheld PC, a smart watch, a personal digital assistant (PDA),a thin client, a fat client, an Internet browser, or other device. Thenetwork-enabled computer systems may execute one or more softwareapplications to, for example, receive data as input from an entityaccessing the network-enabled computer system, process received data.transmit data over a network, and receive data over a network. Forexample, communication between an electronic device 120 and/or mobiledevice 140 may be facilitated using, for example, components illustratedin FIG. 3 to transmit and/or receive data from a backend system, such asfirmware/software provider 130 and/or third party terminal 150. Moredetails regarding the features and functionality of an electronic userdevice are found in, for example, U.S. Provisional Application No.62/270,465 filed on Apr. 14, 2015.

Dynamic transaction card 120, firmware/software provider system 130,mobile device 140 and/or third party terminal 150 may include at leastone central processing unit (CPU), which may be configured to executecomputer program instructions to perform various processes and methods.Dynamic transaction card 120, firmware/software provider system 130,mobile device 140 and/or third party terminal 150 may include datastorage, including for example, random access memory (RAM) and read onlymemory (ROM), which may be configured to access and store data andinformation and computer program instructions. Data storage may alsoinclude storage media or other suitable type of memory (e.g., such as,for example, RAM, ROM, programmable read-only memory⋅ (PROM), erasableprogrammable real-only memory (EPROM), electrically erasableprogrammable read-only memory (EEPROM), magnetic disks, optical disks,floppy disks, hard disks, removable cartridges, flash drives, any typeof tangible and non-transitory storage medium), where the files thatcomprise an operating system, application programs including, forexample, web browser application, email application and/or otherapplications, and data files may be stored. The data storage of thenetwork-enabled computer systems may include electronic information,files, and documents stored in various ways, including, for example, aflat file, indexed file, hierarchical database, relational database,such as a database created and maintained with software from, forexample, Oracle® Corporation, Microsoft® Excel file, Microsoft® Accessfile, a solid state storage device, which may include an all flasharray, a hybrid array, or a server-side product, enterprise storage,which may include online or cloud storage, or any other storagemechanism.

Dynamic transaction card 120, firmware/software provider system 130,mobile device 140 and/or third party terminal 150 may further include,for example, a processor, which may be several processors, a singleprocessor, or a single device having multiple processors. Althoughdepicted as single elements, it should be appreciated that according toone or more embodiments, dynamic transaction card 120, firmware/softwareprovider system 130, mobile device 140 and/or third party terminal 150may comprise a plurality of dynamic transaction cards 120,firmware/software provider systems 130, mobile devices 140 and/or thirdparty terminals 150.

As shown in FIG. 1, dynamic transaction card 120, firmware/softwareprovider system 130. mobile device 140 and/or third party terminal 150may include various components. These components may be understood torefer to computer executable software, firmware, hardware, and/orvarious combinations thereof. It is noted that where a componentincludes software and/or firmware, the components is configured toaffect the hardware elements of an associated system. It is furthernoted that the components shown and described herein are intended asexamples. The components may be combined, integrated, separated, orduplicated to support various applications. Also, a function describedherein as being performed at a particular component may be performed atone or more other components and by one or more other devices instead ofor in addition to the function performed at the particular component.

As depicted in FIG. 1, a dynamic transaction card 120 may include aninput/output interface 122, data storage 124, a secure element 126comprising a cryptographic coprocessor 126 a, an apple (126 b, andmemory 126 c, and/or a separate microprocessor 128. These components ofdynamic transaction card 120 may include various components as describedin, for example, FIGS. 2 and 3.

Input/output interface 122 may include for example, I/O devices, whichmay be configured to provide input and/or output to/from dynamictransaction card 120 (e.g., keyboard, mouse, display, speakers,printers, modems, network cards, etc.). Input/output interface 122 alsomay include antennas, network interfaces that may provide or enablewireless and/or wire line digital and/or analog interface to one or morenetworks, such as network 110, over one or more network connections, apower source that provides an appropriate alternating current (AC) ordirect current (DC) to power one or more components of dynamictransaction card 120, and a bus that allows communication among thevarious components of dynamic transaction card 120. Input/outputinterface 122 may include a display, which may include for exampleoutput devices, such as a printer, display screen (e.g., monitor,television, and the like), speakers, projector, and the like. Althoughnot shown, dynamic transaction card 120 may include one or more encodersand/or decoders, one or more interleavers, one or more circular buffers,one or more multiplexers and/or de-multiplexers, one or more permutersand/or depermuters, one or more encryption and/or decryption units, oneor more modulation and/or demodulation units, one or more arithmeticlogic units and/or their constituent parts, and the like.

Data storage 124 may include random access memory (RAM) and read onlymemory (ROM), which may be configured to access and store data andinformation and computer program instructions, such as firmware and/orother applications. Data storage 124 may also include storage media orother suitable type of memory⋅ (e.g., such as, for example, RAM, ROMprogrammable read-only memory (PROM), erasable programmable read-onlymemory (EPROM), electrically erasable programmable read-only memory(EEPROM), any type of tangible and non-transitory storage medium), wherethe files that comprise an operating system, application programs, anddata files may be stored.

A secure element 126 may include a secure microprocessor, such as an EMVprocessor. Secure element 126 may act as a trusted platform module (TPM)and include several components. For example, secure element 126 mayinclude a cryptographic coprocessor 126 a, an applet 126 b, and/or amemory 126 c. Cryptographic coprocessor 126 a may include a randomnumber generator, a key generator, a hash generator, and/or anencryption/decryption signature engine. An applet 126 b may includeinstructions stored therein that, when executed, initiate a checksumcalculation and comparison as described herein. Memory 126 c may store acryptographic key, a checksum used to validate firmware and/or softwareapplications stored in the dynamic transaction card 120.

Applet 126 b may include scripts, firmware and/or software that may beused to securely update firmware and/or software as disclosed herein.For example, scripts, firmware and/or software may include instructionsto determine if a portion of data received from a secure terminalincludes an entire firmware and/or software update, instruction todecrypt received data using cryptographic coprocessor 126 a, and/or usecryptographic coprocessor 126 a to calculate checksums for comparison asdescribed herein.

Applet 126 b may include instructions that when executed instruct secureelement 126 to run a validation of firmware and/or software at aparticular interval. For example, validation may be performed upon:card-holder request via an input on the transaction card, transactioncard usage, a transaction amount exceeding a threshold for a transactioncard, fraud detection associated with the transaction card, powering-upof the transaction card, waking-up of the transaction card, networkconnection of the transaction card, and/or a transaction card/smartphone connection. Validation may be performed at predefined intervals,where the predefined intervals are stored within the validationprogramming and are defined by transaction card manufacturer, firmwareprovider, software application provider, and/or a transaction cardholder. Validation may occur using various cryptographic algorithms,such as, sha, md5, and/or the like.

Validation may compare a calculated checksum with a checksum stored inEMV chip memory. If the validation determines, for example, that achecksum calculated for firmware and/or a software application stored instorage and/or a separate microprocessor of a transaction card matches achecksum stored in EMV chip memory of the transaction card, thetransaction card may operate normally. If the validation determines, forexample, that a checksum calculated for firmware and/or a softwareapplication stored in a microprocessor of a transaction card does notmatch a checksum stored in EMV chip memory of the transaction card, thetransaction card may freeze all capabilities, erase the memory of thetransaction card, display data indicative of a fraudulent or inactivetransaction card, and/or the like.

Microprocessor 128 may store and/or execute firmware and/or softwareapplications stored in scripts, firmware and/or software 120. Firmwareand/or software applications may be updated and/or validated usingsecure element 126.

Firmware/software provider system 130 may include an input/outputinterface 132, data storage 134, and/or a cryptographic coprocessor 136.Input/output interface 132 may include for example, I/O devices, whichmay be configured to provide input and/or output to/fromfirmware/software provider system 130 (e.g., keyboard, mouse, display,speakers, printers, modems, network cards, etc.). Input/output interface132 also may include antennas, network interfaces that may provide orenable wireless and/or wire line digital and/or analog interface to oneor more networks, such as network 110, over one or more networkconnections, a power source that provides an appropriate alternatingcurrent (AC) or direct current (DC) to power one or more components offirmware/software provider system 130, and a bus that allowscommunication among the various components of firmware/software providersystem 130. Input/output interface 132 may include a display, which mayinclude for example output devices, such as a printer, display screen(e.g., monitor, television, and the like), speakers, projector, and thelike. Although not shown, firmware/software provider system 130 mayinclude one or more encoders and/or decoders, one or more interleavers,one or more circular buffers, one or more multiplexers and/orde-multiplexers, one or more permuters and/or depermuters, one or moreencryption and/or decryption units, one or more modulation and/ordemodulation units, one or more arithmetic logic units and/or theirconstituent parts, and the like.

Data storage 134 may include random access memory (RAM) and read onlymemory (ROM), which may be configured to access and store data andinformation and computer program instructions, such as dynamictransaction card data (e.g., electronic card identifier, checksumsassociated with a dynamic transaction card, private/public key pair dataassociated with a dynamic transaction card, validation data, and/or thelike), instructions to calculate a checksum for firmware and/or softwarestored on a dynamic transaction card, and/or updates to firmware and/orsoftware for a dynamic transaction card. Data storage 134 may alsoinclude storage media or other suitable type of memory (e.g., such as,for example, RAM, ROM, programmable read-only memory (PROM), erasableprogrammable read-only memory (EPROM), electrically erasableprogrammable read-only memory (EEPROM), any type of tangible andnon-transitory storage medium), where the files that comprise anoperating system, application programs, and data files may be stored.Data storage 134 may include secure data storage in order to store userdevice data such as existing versions of firmware and/or software,updates to firmware and/or software, checksum data associated with afirmware and/or software version, private key data, public key data,user account data, user mobile device identifier, and/or the like.

Cryptographic coprocessor 136 may be a TPM that provides secure storagefor storing sensitive data and/or instructions, such as, for example,checksums, private/public key pairs associated with each dynamictransaction card provided to customers and/or other sensitive dataassociated with each dynamic transaction card provided to customers(e.g., transaction data checksum algorithms, hashing algorithms, and/orthe like).

Mobile device 140 may include an input/output interface 142 and/or amobile application 144. Input/output interface 142 may include forexample, I/O devices, which may be configured to provide input and/oroutput to/from mobile device 140 (e.g., keyboard, mouse, display,speakers, printers, modems, network cards, etc.). Input/output interface142 also may include antennas, network interfaces that may provide orenable wireless and/or wire line digital and/or analog interface to oneor more networks, such as network 110, over one or more networkconnections, a power source that provides an appropriate alternatingcurrent (AC) or direct current (DC) to power one or more components ofmobile device 140, and a bus that allows communication among the variouscomponents of mobile device 140. Input/output interface 142 may includea display, which may include for example output devices, such as aprinter, display screen (e.g., monitor, television, and the like),speakers, projector, and the like. Although not shown, mobile device 140may include one or more encoders and/or decoders, one or moreinterleavers, one or more circular buffers, one or more multiplexersand/or de-multiplexers, one or more permuters and/or depermuters, one ormore encryption and/or decryption units, one or more modulation and/ordemodulation units, one or more arithmetic logic units and/or theirconstituent parts, and the like.

Mobile application 144 may include instructions that, when executed,cause various hardware elements within mobile device 140 to performfunctions associated with the instructions. For example, mobileapplication 144 may include instructions that, when executed, causemobile device 140 to communicate with dynamic transaction card 120 andtransmit data to dynamic transaction card 120, such as firmware and/orsoftware updated data. Mobile application 144 may include instructionsthat, when executed, cause mobile device 140 to receive data from adynamic transaction card 120, such as firmware and/or software data(e.g., existing version of firmware and/or software on an associateddynamic transaction card, update log data, and/or the like). Theseinstructions may utilize hardware elements such as input/outputinterface 142 and/or a microprocessor.

Third party terminal 150 may include an input/output interface 152, anapplication 154, and an electronic card reader 156. Input/outputinterface 152 may include for example, I10 devices, which may beconfigured to provide input and/or output to/from third party system 150(e.g., keyboard, mouse, display, speakers, printers, modems, networkcards, etc.). Input/output interface 152 also may include antennas,network interfaces that may provide or enable wireless and/or wire linedigital and/or analog interface to one or more networks, such as network110, over one or more network connections, a power source that providesan appropriate alternating current (AC) or direct current (DC) to powerone or more components of third party system 150, and a bus that allowscommunication among the various components of third party system 150.Input/output interface 152 may include a display, which may include forexample output devices, such as a printer, display screen (e.g.,monitor, television, and the like), speakers, projector, and the like.Although not shown, third party system 150 may include one or moreencoders and/or decoders, one or more interleavers, one or more circularbuffers, one or more multiplexers and/or de-multiplexers, one or morepermuters and/or depermuters, one or more encryption and/or decryptionunits, one or more modulation and/or demodulation units, one or morearithmetic logic units and/or their constituent parts, and the like.

Application 154 may include instructions that, when executed, causevarious hardware elements within third party terminal 150 to performfunctions associated with the instructions. For example, application 154may include instructions that, when executed, cause third party terminal150 to communicate with dynamic transaction card 120 via a card reader156. Application 154 may include instructions to execute a financialtransaction, to connect a firmware and/or software provider system 130with a dynamic transaction card 120 in a secure manner, and/or tovalidate a dynamic transaction card 120. These instructions may utilizehardware elements such as input/output interface 152, microprocessor,and/or other elements described in, for example, FIG. 4.

Card reader 156 may include an EMV reader capable of maintaining contactwith various contact points on and EMV plate residing on the surface ofthe dynamic transaction card 120 during the transmission of data betweena third party terminal 150 (e.g., a PoS terminal/ATM/stand-alone secureterminal) and the dynamic transaction card 120. The connection mayinclude a contactless connection, such as a near-field communication(NFC) connection. The connection may include any other connection asdescribed in FIG. 4.

For example, FIG. 4 depicts an example PoS device 400 as a chargingsystem, which may be similar to third party terminal 150. PoS device 400may provide the interface at what a card holder makes a payment to themerchant in exchange for goods or services. PoS device 400 may includeand/or cooperate with weighing scales, scanners, electronic and manualcash registers, electronic funds transfer at point of sale (EFTPOS)terminals, touch screens and any other wide variety of hardware andsoftware available for use with PoS device 400. PoS device 400 may be aretail point of sale system and may include a cash register and/or cashregister-like computer components to enable purchase transactions. PoSdevice 400 also may be a hospitality point of sale system and includecomputerized systems incorporating registers, computers and peripheralequipment, usually on a computer network to be used in restaurant, hairsalons, hotels or the like.

PoS device 400 may be a wireless point of sale device similar to a PoSdevice described herein or, for example a tablet computer that isconfigured to operate as a PoS device, including for example, softwareto cause the tablet computer to execute point of sale functionality anda card reader such as for example the Capital One® SparkPay card reader,the Square® reader, Intuit's® GoPayment reader, or the like. A mobiledevice may include, for example, mobile device 140. PoS device 400 alsomay be a cloud-based point of sale system that can be deployed assoftware as a service, which can be accessed directly from the Internetusing, for example, an Internet browser.

Referring to FIG. 4, an example PoS device 400 is shown. PoS device 400may include a controller 402, a reader interface 404, a data interface406, a smartcard and/or EMV chip reader 408, a magnetic stripe reader410, a near-field communications (NFC) reader 412, a power manager 414,a keypad 416, an audio interface 418, a touchscreen/display controller420, and a display 422. Also, PoS device 400 may be coupled with,integrated into or otherwise connected with a cash register/retailenterprise system 424.

In various embodiments, Controller 402 may be any controller orprocessor capable of controlling the operations of PoS device 400. Forexample, controller 402 may be an Intel® 2nd Generation Core™ i3 or i5or Pentium™ G850 processor or the like. Controller 402 also may be acontroller included in a personal computer, smartphone device, tablet PCor the like.

Reader interface 404 may provide an interface between the various readerdevices associated with PoS device 400 and PoS device 400. For example,reader interface 404 may provide an interface between smartcard and/orEMV chip reader 408, magnetic stripe reader 410, NFC reader 412 andcontroller 402. In various embodiments, reader interface 404 may be awired interface such as a USB, RS232 or RS485 interface and the like.Reader interface 404 also may be a wireless interface and implementtechnologies such as Bluetooth, the 802.11(x) wireless specificationsand the like. Reader interface 404 may enable communication ofinformation read by the various reader devices from the various readerdevices to PoS device 400 to enable transactions. For example, readerinterface 404 may enable communication of a credit or debit card numberread by a reader device from that device to PoS device 400. In variousembodiments, reader interface 404 may interface between PoS device 400and other devices that do not necessarily “read” information but insteadreceive information from other devices.

Data interface 406 may allow PoS device 400 to pass communicate datathroughout PoS device and with other devices including, for example,cash register/retail enterprise system 424. Data interface 406 mayenable PoS device 400 to integrate with various customer resourcemanagement (CRM) and/or enterprise resource management (ERP) systems.Data interface 406 may include hardware, firmware and software that makeaspects of data interface 406 a wired interface. Data interface 406 alsomay include hardware, firmware and software that make aspects of datainterface 406 a wireless interface. In various embodiments, datainterface 406 also enables communication between PoS device otherdevices.

Dynamic transaction card and/or EMV chip reader 408 may be anyelectronic data input device that connects to the contacts of an EMVplate on a transaction card. Through these connections EMV chip reader408 may transmit power to the dynamic transaction card, read data from adynamic transaction card and/or EMV chip, and send data to the dynamictransaction card and/or EMV chip. Dynamic transaction card and/or EMVchip reader 408 may be capable of supplying an integrated circuit (e.g.,EMV chip) on the dynamic transaction card with electricity andcommunicating with the dynamic transaction card via protocols, therebyenabling read and write functions. In various embodiments, dynamictransaction card and/or EMV chip reader 408 may enable reading fromcontact or contactless dynamic transaction cards. Dynamic transactioncard and/or EMV chip reader 408 also may communicate using standardprotocols including ISO/IEC 7816, ISO/IEC 14443 and/or the like orproprietary protocols.

Magnetic stripe reader 410 may be any electronic data input device thatreads data from a magnetic stripe on a transaction card, for example. Invarious embodiments, magnetic stripe reader 410 may include a magneticreading head capable of reading information from a magnetic stripe.Magnetic stripe reader 410 may be capable of reading, for example,cardholder information from tracks 1, 2, and 3 on magnetic cards. Invarious embodiments, track 1 may be written on a card with code known asDEC SIXBIT plus odd parity and the information on track 1 may becontained in several formats (e.g., format A, which may be reserved forproprietary⋅ use of the card issuer; format B; format C-M which may bereserved for us by ANSI subcommittee X3B10; and format N-Z, which may beavailable for use by individual card issuers). In various embodiments,track 2 may be written with a 5-bit scheme (4 data bits plus 1 parity).Track 3 may be unused on the magnetic stripe. In various embodiments,track 3 transmission channels may be used for transmitting dynamic datapacket information to further enable enhanced token-based payments.

NFC reader 412 may be any electronic data input device that reads datafrom an NFC device. In an example embodiment, NFC reader 412 may enableIndustry Standard NFC Payment Transmission. For example, the NFC reader412 may communicate with an NFC enabled device to enable two loopantennas to form an air-core transformer when placed near one another byusing magnetic induction. NFC reader 412 may operate at 13.56 MHz or anyother acceptable frequency. Also, NFC reader 412 may enable a passivecommunication mode, where an initiator device provides a carrier field,permitting answers by the target device via modulation of existingfields. Additionally, NFC reader 412 also may enable an activecommunication mode by allowing alternate field generation by theinitiator and target devices.

In various embodiments, NFC reader 412 may deactivate an RF field whileawaiting data. NFC reader 412 may receive communications containingMiller-type coding with varying modulations, including 100% modulation.NFC reader 412 also may receive communications containing Manchestercoding with varying modulations, including a modulation ratio ofapproximately 10%, for example. Additionally, NFC reader 412 may becapable of receiving and transmitting data at the same time, as well aschecking for potential collisions when the transmitted signal andreceived signal frequencies differ.

NFC reader 412 may be capable of utilizing standardized transmissionprotocols, for example but not by way of limitation, ISO/IEC 14443 A/B,ISO/IEC 18092, MiFare, FeliCa, tag/smartcard emulation, and the like.Also, NFC reader 412 may be able to utilize transmission protocols andmethods that are developed in the future using other frequencies ormodes of transmission. NFC reader 412 also may be backwards-compatiblewith existing payment techniques, such as, for example RFID. Also, NFCreader 412 may support transmission requirements to meet new andevolving payment standards including internet based transmissiontriggered by NFC. In various embodiments, NFC reader 412 may utilizeMasterCard's® PayPass and/or Visa's® Pay Wave and/or American Express'®ExpressPay systems to enable transactions.

Although not shown and described, other input devices and/or readers,such as for example, barcode readers and the like are contemplated.

Power manager 414 may be any microcontroller or integrated circuit thatgoverns power functions of PoS device 400. Power manager 414 mayinclude, for example, firmware, software, memory, a CPU, a CPU,input/output functions, timers to measure intervals of time, as well asanalog to digital converters to measure the voltages of the main energystorage component or power source of PoS device 400. In variousembodiments, power manager 414 remains active even when PoS device 400is completely shut down, unused, and/or powered by the backup energystorage component. Power manager 414 may be responsible for coordinatingmany functions, including, for example, monitoring power connections andenergy storage component charges, charging batteries when necessary,controlling power to other integrated circuits within PoS device 400and/or other peripherals and/or readers, shutting down unnecessarysystem components when they are left idle, controlling sleep and powerfunctions (on and off), managing the interface for built-in keypad andtrackpads, and/or regulating a real-time clock (RTC).

Keypad 416 may any input device that includes a set of buttons arranged,for example, in a block or pad and may bear digits, symbols and/oralphabetical letters. Keypad 416 may be a hardware-based ormechanical-type keypad and/or implemented in software and displayed on,for example, a screen or touch screen to form a keypad. Keypad 416 mayreceive input from a user that pushed or otherwise activates one or morebuttons on keypad 416 to provide input.

Audio interface 418 may be any device capable of providing audio signalsfrom PoS device 400. For example, audio interface may be a speaker orspeakers that may produce audio signals. In various embodiments, audiointerface 418 may be integrated within PoS device 400. Audio interface418 also may include components that are external to PoS device 400.

Touchscreen/display control 420 may be any device or controller thatcontrols an electronic visual display. Touchscreen/display control 420may allow a user to interact with PoS device 400 through simple ormulti-touch gestures by touching a screen or display (e.g., display422). Touchscreen/display control 420 may be configured to control anynumber of touchscreens, including, for example, resistive touchscreens,surface acoustic wave touchscreens, capacitive touchscreens, surfacecapacitance touchscreens, projected capacitance touchscreens, mutualcapacitance touchscreens, self-capacitance touchscreens, infrared gridtouchscreens, infrared acrylic projection touchscreens, opticaltouchscreens, touchscreens based on dispersive signal technology,acoustic pulse recognition touchscreens, and the like. In variousembodiments, touchscreen/display control 420 may receive inputs from thetouchscreen and process the received inputs. Touchscreen/display control420 also may control the display on PoS device 400, thereby providingthe graphical user interface on a display to a user of PoS device 400.

Display 422 may be any display suitable for a PoS device. For example,display 422 may be a TFT, LCD, LED, or other display. Display 422 alsomay be a touchscreen display that for example allows a user to interactwith PoS device 400 through simple or multi-touch gestures by touching ascreen or display (e.g., display 422). Display 422 may include anynumber of touchscreens, including, for example, resistive touchscreens,surface acoustic wave touchscreens, capacitive touchscreens, surfacecapacitance touchscreens, projected capacitance touchscreens, mutualcapacitance touchscreens, self-capacitance touchscreens, infrared gridtouchscreens, infrared acrylic projection touchscreens, opticaltouchscreens, touchscreens based on dispersive signal technology,acoustic pulse recognition touchscreens, and the like. In variousembodiments, 422 may receive inputs from control gestures provided by auser. Display 422 also may display images, thereby providing thegraphical user interface to a user of PoS device 400.

Cash register/retail enterprise system 424 may me any device or devicesthat cooperate with PoS device 400 to process transactions. Cashregister/retail enterprise system 424 may be coupled with othercomponents of, PoS device 400 via, for example, a data interface (e.g.,data interface 406) as illustrated in FIG. 4. Cash register/retailenterprise system 424 also may be integrated into PoS device 400.

In various embodiments, cash register/retail enterprise system 424 maybe a cash register. Example cash registers may include, for example,mechanical or electronic devices that calculate and record salestransactions. Cash registers also may include a cash drawer for storingcash and may be capable of printing receipts. Cash registers also may beconnected to a network to enable payment transactions. Cash registersmay include a numerical pad, QWERTY or custom keyboard, touch screeninterface, or a combination of these input methods for a cashier toenter products and fees by hand and access information necessary tocomplete the sale.

In various embodiments, cash register/retail enterprise system 424 maycomprise a retail enterprise system and/or a customer relationshipmanagement system. Retail enterprise system 424 may enable retainenterprises to manage operations and performance across a retailoperation. Retail enterprise system 424 may be a stand-alone applicationin, for example, individual stores, or may be interconnected via anetwork. Retail enterprise system 424 may include various point of salecapabilities, including the ability to, for example, customize andresize transaction screens, work with a “touch screen” graphical userinterface, enter line items, automatically look up price (sales,quantity discount, promotional, price levels), automatically computetax, VAT, look up quantity and item attribute, display item picture,extended description, and sub-descriptions, establish default shippingservices, select shipping carrier and calculate shipping charges byweight/value, support multi-tender transactions, including cash, check,credit card, and debit card, accept food stamps, place transactions onhold and recall, perform voids and returns at PoS, access online creditcard authorizations and capture electronic signatures, integrate debitand credit card processing, ensure optional credit card discounts withaddress verification, support mix-and-match pricing structure, discountentire sale or selected items at time of sale, add customer account,track customer information, including total sales, number of visits, andlast visit date, issue store credit, receive payment(s) for individualinvoices, process deposits on orders, search by customer's ship-toaddress, create and process layaway, back orders, work orders, and salesquotes, credit items sold to selected sales reps, view daily sales graphat the PoS, view and print journals from any register, preview, search,and print journals by register, batch, and/or receipt number, print X,Z, and ZZ reports, print receipts, invoices, and pick tickets withlogos/graphics, print kit components on receipt, reprint receipts, enteremployee hours with an integrated time clock function, and/or sell whenthe network/server is down with an offline PoS mode. Retail enterprisesystem 424 also may include inventory control and tracking capabilities,reporting tools, customer management capabilities, employee managementtools, and may integrate with other accounting software.

In various embodiments cash register/retail enterprise system 424 may bea hospitality PoS. In such embodiments, retail enterprise system 424 mayinclude hospitality PoS software (e.g., Aloha PoS Restaurant softwarefrom NCR®, Micros® RES and Symphony software and the like), hospitalitymanagement software, and other hardware and software to facilitatehospitality operations.

As discussed above, an electronic device having a TPM may include adynamic transaction card. FIG. 2 depicts an example dynamic transactioncard 200 with an EMV chip 212 (e.g., an EMV processor as describedherein, that may serve as a TPM. EMV processor 212 may be similar tosecure element 126 described in FIG. 1.

As shown in FIG. 2, dynamic transaction card 200 may include a topoutput layer 202. The top output layer may be a film covering, a plasticcovering, and/or the like. The top output layer 202 may be constructedof scratch-resistant and/or scratch-proof materials. Materials that maybe used as a top outer layer 202 may include polyvinyl chloride (PVC),polylactic acid (PLA), acrylonitrile butadiene styrene (ABS),polyethylene terephthalate (PET), Polyethylene terephthalateglycol-modified (PET-G), and/or the like. A dynamic transaction card 200may further include a top protective layer 204, such as a clearscratch-resistant coating and/or scratch-proof material to protect theunderlying components. For example, various scratch-resistant materialsinclude materials coated with a scratch resistant chemical coating, suchas a UV curable chemical coating. Scratch-proof materials may include amineral glass, a sapphire glass material, PVC, PET, and/or PET-G.

A dynamic transaction card 200 may include a potting 206 or filler epoxyaround the electrical components to provide strength and/or waterresistance. A potting 206 may include a light guide, which may beconstructed of optical grade materials such as acrylic, resin,polycarbonate, epoxies, and/or glass. Potting 206 may also includeinjection molding, such as over molding and/or multi-shot to encapsulatethe internal components of card 200. For example, injection molding mayinclude ABS, thermoplastic elastomers (TPE), thermoplastic vulcanizates(TPV), thermoplastic polyurethane (TPU), PET, polycarbonates (PC),and/or silicone.

A dynamic transaction card 200 may further include a Java Applet 208 andJava Applet integration 210. Although a Java Applet 208 is used throughthe specification, any other similar type of code application may beused. Moreover, although Java Applet integration 210 is used throughoutthis specification, any type of interface may be used to allow themicrocontroller to interact with the EMV processor. A Java Applet 208may include code that executes payments, such as payment made using anEMV processor. A Java Applet 208 may include account-provider specificcode to execute display functionality specific to the account provider.Java Applet integration 210 may include coded interfaces to allow themicrocontroller to interact with the EMV processor 212.

An EMV processor 212 may be connected to an EMV plate on the surface oftransaction card 200, where the EMV plate may include a number ofcontacts that may interact with a terminal, such as third party terminal150. During an EMV interaction, application cryptograms may be used tosend and receive data packets between the dynamic transaction card 200and a terminal. For example, data packets may include userauthentication information which an acquisition system and/or issuingfinancial institution may use to authenticate a transaction card 200during a transaction. Data packets may also include firmware and/orsoftware update data, such as a portion or all of an updated firmwareand/or software version, a cryptographic key associated with a firmwareand/or software update, and/or a checksum associated with a firmwareand/or software update.

Various cryptographic protocols and/or methods may be used in this datatransmission and reception process. Moreover, during a transactionissuing financial institutions and/or acquisition systems may returnscript commands to the EMV processor 212 via a terminal. These scriptcommands and/or data packets may be transmitted between parties over anetwork. Script commands may be used, for example, to blocktransactions, change transaction data stored on the EMV processor (e.g.,transaction history, account limits, account balance, and/or the like).Offline data authentication may also take place using, for examplepublic key cryptography to perform payment data authentication. Forexample, offline data authentication may use Static Data Authentication(SDA), Dynamic Data Authentication (DDA), and/or Combined DataAuthentication (CDA).

EMV processor 212 may also include a set of rules and/or EMV scripts toupdate firmware and/or software stored on dynamic transaction card 200.For example, EMV scripts may allow an issuer (e.g., firmware/softwareprovider system 130, third party system 150, and/or firmware/softwareprovider system 130 or third party system 150 via mobile device 140) toupdate and change a set of rules, various parameters (e.g., cardsettings, fraud settings, and/or the like), and data (e.g., keyinformation, identifiers, and/or the like) stored in EMV chip 212 and/orelsewhere on card 200. EMV scripts may be activated via a terminal(e.g., third party terminal 150 and/or the like) and/or a mobile deviceconnected via a network to an issuer system (e.g., issuer system viamobile device 140). EMV scripts may be pre-loaded on EMV processor 212and/or delivered, in whole or in part via commands to update a script,after a card has been issued.

EMV processor 212 may include storage for cryptographic keys (e.g.,public keys, private keys, and/or the like), checksums, and/or othervalidation data associated with firmware and/or software stored on thedynamic transaction card 200. EMV processor 212 may include an applet toinitiate firmware/software update validation by calculating a newchecksum for the firmware/software update on dynamic transaction card200 and comparing that new checksum to a checksum received via a secureterminal, such as third party terminal 150 and/or a mobile device, suchas mobile device 140.

EMV processor may include storage for firmware and/or software alongwith firmware and or software update logs. EMV processor may execute areceived firmware and/or software update as described herein in FIG. 6,using data received via a third party terminal, such as third partyterminal 150 and/or via a mobile device associate with the dynamictransaction card 200, such as mobile device 140. For example, should afirmware and/or software update be permitted, EMV processor 212 mayinstruct components (e.g., bootloader 222) on dynamic transaction card200 to update firmware and/or software stored on dynamic transactioncard. If, however, firmware and/or software update is not permitted, EMVprocessor 212 may instruct one or more components of dynamic transactioncard 200 to take some form of action and/or EMV processor 212 mayexecute a corrective action itself. A corrective action may includezeroing, wiping, or deactivating dynamic transaction card 200. Zeroing,wiping, and/or deactivating a dynamic transaction card may be performedvia an erase script to erase the entire or a portion of the memory ofcard 200, a script to sever a connection, and/or the like. A correctiveaction may include transmitting a notification to a firmware/softwareprovider system, such as firmware/software provider system 130, a mobiledevice associated with the dynamic transaction card, such as mobiledevice 140, and/or a third party system (e.g., merchant system, fraudalert system, and/or the like), such as third party system 150.

Dynamic transaction card 200 may also include one or more sensors 214 toreceive input. Sensors 214 may include an activation sensor and/or anoperation sensor, which may be combined and/or separate. An activationsensor may activate the dynamic transaction card 200 and an operationsensor may instruct the dynamic transaction card 200 to perform anaction based on the received input. An activation sensor may require asecurity input, such as a biometric input (e.g., fingerprint, eye scan,voice recognition, and/or the like), input indicative of a paired mobiledevice (e.g., BLE and/or Bluetooth pairing), input indicative of apassword (e.g., a password received via a sensor on the dynamictransaction card and/or a password received on a paired mobile device),and/or the like. An operation sensor may change a display 216 based onreceived input, conduct a transaction via, for example an EMV processor212 and/or contactless payment technologies based on received input,attempt a pairing of a card 200 and a mobile device, and/or the like.

By way of example, a sensor 214 may include a capacitive touch sensor, apiezoelectric sensor, load cells, a light sensor, a temperature sensor,a resistive touchscreen, including for example an analogue matrix real(AMR) sensors, and/or the like. Sensors 214 may include accelerometersto detect motion input.

Although the sensor 214 is depicted at a particular spot in thetransaction card 200, a sensor 214 may be placed at any portion of thecard to detect, for example, touch, light, heat, energy, and/or thelike. For example, a sensor may be placed around the outer edges of adynamic transaction card 200 or at any spot within the dynamictransaction card 200. Sensor 214 also may include the entire exteriorsurface of transaction card 200.

A display 216 may be provided within the transaction card 200. Althoughthe display as shown includes, for example, a dot matrix display, anumber of other display options may be included in the transaction card200. For example, lighting, such as LED lighting, OLED lighting, and/orthe like, may be used as display components. Display components may alsoinclude electronic paper, Mirasol, TF LCD, Quantum Dot Display, and/orthe like. Where lighting is used, various lighting technologies may beused to create a display that indicates a number of things to acardholder. For example, edge lighting may be used to create a specificvisual component in the display. A number of LED or OLED lights may beused to illuminate various portions of the display in order to outputinformation to a card holder.

By way of example, a display 216 may be illuminated using a particularcolor to relay to the cardholder balance information of an accountassociated with a transaction card, such as an RGB LED matrix paneland/or RGB LED displays. A red light display may indicate that theaccount balance is within a first predetermined dollar amount or a firstpredetermined percentage of the total spending limit, a particularbudget, a particular budget category, and/or the like. A yellow lightdisplay may indicate that the account balance is within a secondpredetermined dollar amount or a second predetermined percentage of thetotal spending limit, a particular budget, a particular budget category,and/or the like. A green light display may indicate that the accountbalance is within a third predetermined dollar amount or a thirdpredetermined percentage of the total spending limit, a particularbudget, a particular budget category, and/or the like. Various colorsand or number of categories may be used to output this information to acardholder. A display 216 may include other display component, such as,for example, LCD technology, ePaper technology (e.g., E-Ink), vacuumflorescent display technology, and/or the like.

By way of example, a display may include a number of LED or OLED lightsthat may be lit in a particular pattern to indicate transaction and/oraccount information. For example, a display may include a circle,semicircle, or other shape of LED or OLED lighting, where the number oflights illuminated indicates a dollar amount or a percentage of thetotal spending limit, a particular budget, a particular budget category,and/or the like.

A display may be altered and/or modified, for example, for example,where dynamic transaction card 200 includes a debit account, a firstcredit account, and a second credit account, display components 216 mayreflect the card number, security code, expiration date, and/or othernecessary data indicative of the account (e.g., second credit account)that is being used to execute a transaction. A display may be alteredand/or modified when, for example, a dynamic transaction card 200receives new card data and/or new account data from an account holder'smobile device via a wireless connection and/or a terminal via acontact-based or contactless connection.

For example, where an account has been marked as associated withfraudulent activity and/or an invalid firmware and/or software update,an account holder and/or issuing financial institution may deactivatethe card associated with the account and issue a new card. New card datamay be transmitted from the issuing financial institution to, forexample, an account holder's mobile device or a third party terminal viaa network, and then from an account holder's mobile device or a thirdparty terminal to electronic card 200 via a contact-based or contactlessconnection. A display may also be altered and/or modified whenelectronic card 200 activates a new account. For example, when anaccount holder applies for a new account (e.g., a new credit cardaccount, a new checking account, and/or the like), if approved, newaccount data may be transmitted to electronic card 200. New account datamay be received at an account holder's mobile device from an issuingfinancial institution via a network (e.g., using a mobile application,mobile optimized website, and/or the like). New account data may then betransmitted from an account holder's mobile device to electronic card200 via a wireless connection (e.g., BLE, RFID, NFC, WiFi, optical,and/or the like) or a contact connection (e.g., using a terminal incontact with an EMV chip and/or other microchip).

A dynamic transaction card 200 may include a display driver 218 thattranslates instructions from a microcontroller 224 into display imagesto be displayed using display components 216. A display driver 218 mayinclude an integrated circuit (IC), a state machine, and/or the likethat provides an interface function between the display and themicrocontroller 224. A display driver 218 may include memory (e.g., RAM,Flash, ROM, and/or the like) and/or firmware that includes font displaydata.

A dynamic transaction card 200 may include firmware 220 and/or abootloader 222. Firmware 220 may be updated as described herein usingEMV processor 212. A bootloader 222 may include code to be executed asan electronic card 200 is activated and before any operating system,firmware, or other code is executed on the dynamic transaction card 200.A bootloader may be activated via a sensor 214 and power source 228 ofthe dynamic transaction card 200. Bootloader 222 may be activated and/orload an application and/or program upon detection that card 200 has beeninserted into a terminal, charger, and/or the like. Bootloader 22 may beactivated and/or load firmware and/or software updates upon receivinginstructions to do so. Bootloader 222 may be activated using only onetechnique described herein, using multiple techniques described herein,and/or using a card holder or card provider selected technique(s)described herein. Bootloader 222 may only be active during a shortinterval after the card 200 powers up and/or receives instructions asdescribed herein. Card 200 may also be activated using program code thatmay be flashed directly to a microprocessor such as microcontroller 224,EMV processor 212, and/or the like. Card 200 may not use a bootloader222 for all features, such as cycling between a sleep state and anactive state. For example, card 200 may cycle between a sleep state andan active state using program code and/or memory.

A dynamic transaction card 200 may include a microcontroller 224 and anantenna 226. Antenna 226 may include, for example, a loop antenna, afractal antenna, and/or the like. Antenna 226 may transmit to andreceive signals from a mobile device, such as mobile device 140, toconduct transactions and display data as described throughout thespecification. Microcontroller 224 may communicate with EMV processor212, Java Applet 208, Java Applet integration 210, sensor(s) 214, powermanagement 230, antenna 226, power source 228, display 216, displaydriver 218, firmware 220, bootloader 222, and/or any other component ofdynamic transaction card 200. Microcontroller 224 may control the cardoperations to conduct transactions and/or display data as describedthroughout this specification.

Dynamic transaction card 200 may include a power source 228 and a PCB232. Although energy storage component is depicted as a single componentseparated from PCB 232, as described herein power source component 228may be manufactured to be integrated with PCB 232 such that the internalenergy storage components lie directly on PCB 232 and PCB 232 acts as acovering for the internal energy storage components as described in U.S.Provisional Patent Application No. 62/266,324, which is incorporatedherein by reference. By way of example, power source component 228 mayinclude a lithium polymer battery’, a lithium-metal battery,lithium-ceramic battery, and/or any other type of battery. Power source228 may be constructed out of rigid materials, semi flexible materials,and/or flexible materials. Power source 228 may provide power to cardcomponents contained within dynamic transaction card 200. Power sourcecomponent 228 may be a combine battery/potting component to supportdynamic transaction card 200.

Dynamic transaction card 200 may include a power management component230 that may manage the charging and discharging of power source 228.Power management component 230 may convert voltage to a predeterminedlevel in order to operate dynamic transaction card 200 as discussedthroughout the specification. Power management component 230 and/orpower source 228 may include, for example, solar power cells to convertsolar energy into an electrical current within a solar panel. Powermanagement component 230 and/or power source 228 may include connectionsto sensors 214 to receive input and activate dynamic transaction card200 (e.g., motion input, thermal input, manual input, touch input,and/or the like).

A flexible printed circuit board (PCB) 232 may be included in dynamictransaction card 200. A flexible PCB 232 may include a PCB mounted in aflexible plastic substrate, such as for example, a polyimide, polyetherether ketone, and/or a transparent conductive polyester film. A flexiblePCB 232 may be printed, using, for example screen printing, 3D printing,and/or the like, to arrange circuits on a material, such as polyester.Flexible PCB 232 may control and/or provide integration between thecomponents of card 200. For example, flexible PCB 232 mechanicallysupports and electronically connects the electronic components of card200 using, for example, conductive tracks, pads, and/or other features.A flexible printed circuit (FPC) may be used in place of or inconjunction with flexible PCB 232. FPC 232 may be fabricated withphotolithographic technology, such as light exposure of a film materiallaminated to substrate and/or conductive layers. FPC 232 may be printed,silkscreened, and/or the like. FPC 232 may be used as a structuralmember for the electronic components of card 200 and/or for the cardsystem as a whole 200.

Dynamic transaction card 200 may include a chassis 234 as a frame orsupporting structure. Chassis 234 may be a mount for a flexible PCB 232with a power source 228/230, which may include an integrated energystorage component and may be constructed out of flexible orsemi-flexible material as well. Chassis 234 may be constructed out of anumber of materials, including but not limited to, styrene,polycarbonate, polyester, and PET. Chassis 234 may be constructed out ofa conductive material. Chassis 234 may increase the rigidity of dynamictransaction card 200 to prevent damage. Chassis 234 may also be used todetect if dynamic transaction card 200 is being held by includingsensors 214 around chassis 234. Where chassis 234 is constructed out ofa conductive material, a dielectric constant of chassis 234 and/or card200 may be monitored to detect handling of card 200. Chassis 234 may beincluded within or separate from a card backing 236. Card backing 236may include a magnetic stripe that may be read using a magnetic stripereader. A magnetic strip may store tracks of data that are used toconduct a transaction using a dynamic transaction card 200. The tracksof data may include a first track capable of storing alphanumericcharacters as well as symbols (e.g., ?, !, &, #, and/or the like), suchas account numbers, account holder name, expiration data, security data,and/or other account and/or card related data. The tracks of data mayinclude a second track capable of storing numeric characters such asaccount numbers, expiration data, security data, and/or other accountand/or card related data. The tracks of data may include a third trackof data capable of storing numeric characters such as an account number,a PIN, a country code, a currency code, an authorization amount, abalance amount, and/or other account and/or card related data.

A magnetic stripe may be dynamically altered. For example, a dynamictransaction card 200 that is paired to a mobile device via, for example,Bluetooth, BLE, RFID, and/or other wireless technologies, may receivenew track data. The new track data may be unformatted, encrypted,encoded, and/or the like when the new track data is transmitted from themobile device to the dynamic transaction card 200. Upon receipt of thenew track data, the new track data may be routed to a microprocessor,such as EMV processor 212 and/or microcontroller 224. EMV processor 212and/or microcontroller 224 may convert, decrypt, and/or decode thereceived new track data to ensure compliance with any standards. Oncedecrypted, decoded, and/or formatted, the new track data may be saved onthe tracks of the magnetic stripe. The magnetic stripe may be deletedand then the new track data may be recorded onto the tracks. In thismanner, track data stored on a magnetic stripe may be altered at anytime upon pairing a dynamic transaction card 200 with a mobile device.

Card backing 236 may be made of similar material to that of the outputlayer 202 and/or the top protective layer 204. Card backing 236 may bemade out of a plastic material.

Although the components of dynamic transaction card 200 are illustratedin a particular fashion, these components may be combined and or placedthroughout a dynamic transaction card 200 in any manner, such as thosedepicted in, for example, FIG. 3.

For example, FIG. 3 illustrates an electric transaction card having anoutput layer 302 which may be similar to output layer 202; an outerprotective layer 304 which may be similar to outer protective layer 204;potting 306 which may be similar to potting 206; Java Applets 308 whichmay be similar to Java Applets 208; Java Applet integration 310 whichmay be similar to Java Applet integration 210; an EMV chip 312 which maybe similar to EMV processor 212; a sensor 314 which may be similar tosensor 214; display 316 which may be similar to display 216; displaydriver 318 which may be similar to display driver 218; firmware 320which may be similar to firmware 220; bootloader 322 which may besimilar to bootloader 222; microcontroller 324 which may be similar tomicrocontroller 224; antenna 326 which may be similar to antenna 226;power source 328 which may be similar to power source 228; powermanagement 330 which may be similar to power management 230; a flexiblePCB 332 which may be similar to flexible PCB 232; chassis 334 which maybe similar to chassis 234; and/or card backing 336 which may be similarto card backing 236.

As discussed above, a dynamic transaction card may communicate with afirmware and/or software provider system via a mobile device. Forexample, a mobile device may store an application associated with afirmware and/or software provider (e.g., a mobile banking application),where a firmware and/or software provider system (e.g., the financialinstitution associated with the mobile banking application) may transmitdata to and receive data from the mobile device via the application overa network. This data may then be transmitted to a dynamic transactioncard via a network (e.g., Bluetooth, BLE, WiFi, RFID, and/or the like)and/or data may be transmitted from a dynamic transaction card to afirmware and/or software provider application on a mobile device via anetwork for retransmission to the firmware and/or software providersystem. Data transmission between a mobile device and a firmware and/orsoftware provider system may occur using components as described in FIG.5.

For example, system 500 may include a user device 502, which may besimilar to mobile device 140 and/or third party terminal 150, a network504, which may be similar to network 110, a front-end controlled domain506, a back-end controlled domain 512, and a backend 518, which may besimilar to firmware and/or software provider system 130. Front-endcontrolled domain 506 may include one or more load balancers 508 and oneor more web servers 510. Back-end controlled domain 512 may include oneor more load balancers 514 and one or more application servers 516.

User device 502 may be a network-enabled computer. As referred toherein, a network-enabled computer may include, but is not limited to:e.g., any computer device, or communications device including, e.g., aserver, a network appliance, a personal computer (PC), a workstation, amobile device, a phone, a smart watch, a handheld PC, a personal digitalassistant (PDA), a thin client, a fat client, an Internet browser, orother device. The one or more network-enabled computers of the examplesystem 400 may execute one or more software applications to enable, forexample, network communications.

User device 502 may include an iPhone, iPod, iPad, and/or Apple Watchfrom Apple® or any other mobile device running Apple's iOS operatingsystem, any device running Google's Android® operating system, includingfor example, Google's wearable device, Google Glass, any device runningMicrosoft's Windows® Mobile operating system, and/or any othersmartphone or like wearable mobile device.

Network 504 may be one or more of a wireless network, a wired network,or any combination of a wireless network and a wired network. Forexample, network 404 may include one or more of a fiber optics network,a passive optical network, a cable network, an Internet network, asatellite network, a wireless LAN, a Global System for MobileCommunication (GSM), a Personal Communication Service (PCS), a PersonalArea Networks, (PAN), D-AMPS, Wi-Fi, Fixed Wireless Data, IEEE 802.11b,802.15.1, 802.11n, and 802.11g or any other wired or wireless networkfor transmitting and receiving a data signal.

In addition, network 504 may include, without limitation, telephonelines, fiber optics, IEEE Ethernet 902.3, a wide area network (WAN), alocal area network (LAN) or a global network such as the Internet. Also,network 504 may support an Internet network, a wireless communicationnetwork, a cellular network, or the like, or any combination thereof.Network 504 may further include one network, or any number of exampletypes of networks mentioned above, operating as a stand-alone network orin cooperation with each other. Network 504 may utilize one or moreprotocols of one or more network elements to which they arecommunicatively couples. Network 504 may translate to or from otherprotocols to one or more protocols of network devices. Although network504 is depicted as a single network, it should be appreciated thataccording to one or more embodiments, network 404 may comprise aplurality of interconnected networks, such as, for example, theInternet, a service provider's network, a cable television network,corporate networks, and home networks.

Front-end controlled domain 506 may be implemented to provide securityfor backend 518. Load balancer(s) 508 may distribute workloads acrossmultiple computing resources, such as, for example computers, a computercluster, network links, central processing units or disk drives. Invarious embodiments, load balancer(s) 510 may distribute workloadsacross, for example, web server(s) 516 and/or backend 518 systems. Loadbalancing aims to optimize resource use, maximize throughput, minimizeresponse time, and avoid overload of any one of the resources. Usingmultiple components with load balancing instead of a single componentmay increase reliability through redundancy. Load balancing is usuallyprovided by dedicated software or hardware, such as a multilayer switchor a Domain Name System (DNS) server process.

Load balancer(s) 508 may include software that monitoring the port whereexternal clients, such as, for example, user device 502, connect toaccess various services of a financial institution, for example. Loadbalancer(s) 508 may forward requests to one of the application servers516 and/or backend 518 servers, which may then reply to load balancer508. This may allow load balancer(s) 508 to reply to user device 502without user device 502 ever knowing about the internal separation offunctions. It also may prevent mobile devices from contacting backendservers directly, which may have security benefits by hiding thestructure of the internal network and preventing attacks on backend 518or unrelated services running on other ports, for example.

A variety of scheduling algorithms may be used by load balancer(s) 508to determine which backend server to send a request to, Simplealgorithms may include, for example, random choice or round robin. Loadbalancers 508 also may account for additional factors, such as aserver's reported load, recent response times, up; down status(determined by a monitoring poll of some kind), number of activeconnections, geographic location, capabilities, or how much traffic ithas recently been assigned.

Load balancers 508 may be implemented in hardware and/or software. Loadbalancer(s) 508 may implement numerous features, including, withoutlimitation: asymmetric loading; Priority activation: SSL Offload andAcceleration; Distributed Denial of Service (DDoS) attack protection;HTTP/HTTPS compression; TCP offloading; TCP buffering; direct serverreturn; health checking; HTTP/HTTPS caching; content filtering;HTTP/HTTPS security; priority queuing: rate shaping; content-awareswitching; client authentication; programmatic traffic manipulation;firewall; intrusion prevention systems.

Web server(s) 510 may include hardware (e.g., one or more computers)and/or software (e.g., one or more applications) that deliver webcontent that can be accessed by, for example a client device (e.g., userdevice 502) through a network (e.g., network 504), such as the Internet.In various examples, web servers, may deliver web pages, relating to,for example, online banking applications and the like, to clients (e.g.,user device 502). Web server(s) 510 may use, for example, a hypertexttransfer protocol (HTTP/HTTPS or sHTTP) to communicate with user device502. The web pages delivered to client device may include, for example,HTML documents, which may include images, style sheets and scripts inaddition to text content.

A user agent, such as, for example, a web browser, web crawler, ornative mobile application, may initiate communication by making arequest for a specific resource using HTTP/HTTPS and web server 510 mayrespond with the content of that resource or an error message if unableto do so. The resource may be, for example a file on stored on backend518. Web server(s) 510 also may enable or facilitate receiving contentfrom user device 502 so user device 502 may be able to, for example,submit web forms, including uploading of tiles.

Web server(s) also may support server-side scripting using, for example,Active Server Pages (ASP), PHP, or other scripting languages.Accordingly, the behavior of web server(s) 510 can be scripted inseparate files, while the actual server software remains unchanged.

Load balancers 514 may be similar to load balancers 408 as describedabove.

Application server(s) 516 may include hardware and/or software that isdedicated to the efficient execution of procedures (e.g., programs,routines, scripts) for supporting its applied applications. Applicationserver(s) 516 may comprise one or more application server frameworks,including, for example, Java application servers (e.g., Java platform.Enterprise Edition (Java EE), the .NET framework from Microsoft®, PHPapplication servers, and the like). The various application serverframeworks may contain a comprehensive service layer model. Also,application server(s) 516 may act as a set of components accessible to,for example, a financial institution, or other entity implementingsystem 500, through an API defined by the platform itself. For Webapplications, these components may be performed in, for example, thesame naming environment as web server(s) 510, and application servers416 may support the construction of dynamic pages. Application server(s)516 also may implement services, such as, for example, clustering,fail-over, and load-balancing. In various embodiments, where applicationserver(s) 516 are Java application servers, the web server(s) 516 maybehaves like an extended virtual machine for running applications,transparently handling connections to databases associated with backend518 on one side, and, connections to the Web client (e.g., user device402) on the other.

Backend 518 may include hardware and/or software that enables thebackend services of, for example, a financial institution, merchant, orother entity that maintains a distributed system similar to system 500.For example, backend 518 may include, a system of record, online bankingapplications, encryption applications, BLE/Bluetooth connectionplatforms, a rewards platform, a payments platform, a lending platform,including the various services associated with, for example, auto andhome lending platforms, a statement processing platform, one or moreplatforms that provide mobile services, one or more platforms thatprovide online services, a card provisioning platform, a general ledgersystem, and/or a location system, which may include additionalcapabilities, such as transaction card data generation, transactionprocessing, and/or transmission of account and/or transaction data.Backend 518 may be associated with various databases, including accountdatabases that maintain, for example, cardholder information (e.g.,demographic data, credit data, cardholder profile data, and/or thelike), transaction card databases that maintain transaction card data(e.g., transaction history, account balance, spending limit, budgetcategories, budget spending, budget limits, and/or the like), securityand connection information (e.g., public/private key pairs, UUIDs,device identifiers, and/or the like), firmware and/or softwareinformation (e.g., firmware and/or software versions, firmware and/orsoftware updates, firmware and/or software logs, and/or the like),and/or other data discussed herein. Backend 518 also may be associatedwith one or more servers that enable the various services provided bysystem 500. Backend 518 may enable a financial institution to implementvarious functions associated with programming, updating, and/orreprogramming a dynamic transaction card as described herein.

Securely updating firmware and/or software on a dynamic transaction cardusing the system components described herein may occur via the method600 described in FIG. 6. For example, a secure firmware and/or softwareupdate may start at block 602.

At block 604, a dynamic transaction card may connect with a firmwareand/or software provider system via a secure terminal connection. Adynamic transaction card may include an EMV chip with an EMV processorand an EMV plate as illustrated, for example, in FIGS. 2 and 3. A secureterminal connection may, for example, be a connection between a dynamictransaction card and a secure terminal, such as a POS terminal, an ATM,and/or a stand-alone secure terminal. A secure connection between adynamic transaction card and a secure terminal may include a contactconnection where the POS terminal/ATM/stand-alone secure terminalincludes an EMV reader capable of maintaining contact with variouscontact points on and EMV plate residing on the surface of the dynamictransaction card during the transmission of data between the POSterminal/ATM/stand-alone secure terminal and the dynamic transactioncard as discussed with respect to FIG. 4. The connection may include acontactless connection, such as a near-field communication (NFC)connection.

During this connection, a version number (e.g., 2 bytes of data)assigned to firmware and/or software stored on the dynamic transactioncard may be transmitted to the secure terminal. A secure terminal maystore current firmware and/or software version number data to compare areceived version number with current version data to determine whether afirmware and/or software provider system should send firmware and/orsoftware data within transaction data packets. If a secure terminaldetermines that the firmware and/or software stored on the dynamictransaction card requires an update, the secure terminal may decide thatthe transaction or interaction with the terminal requires on-lineauthorization or on-line communication, respectively. A dynamictransaction card may transmit an indicator to a secure terminal atpredefined intervals (e.g., every x number of transactions, every xnumber of communications, every⋅ x days, every x weeks, etc.) thatindicates a transaction and/or communication requires on-lineauthorization and/or communication.

An on-line authorization and/or communication may allow the issuer(e.g., firmware and/or software provider) to review the authorizationand/or communication. In reviewing the authorization and/orcommunication, an issuer (e.g., firmware and/or software provider) mayreview a data indicator that indicates a version of firmware and/orsoftware stored on a dynamic transaction card and/or a need for anupdate to the firmware and/or software on the dynamic transaction cardinvolved in the authorization request and/or communication based on asecure terminal determination that the firmware and/or software storedon the dynamic transaction card is not a current version available. Inreviewing the authorization and/or communication, an issuer (e.g.,firmware and/or software provider) may review a data indicator thatindicates a version of the firmware and/or software on the dynamictransaction card involved in the authorization request and/orcommunication (e.g., when a dynamic transaction card requires an on-lineauthorization and/or communication at a predefined interval). An issuerand/or firmware and/or software provider may store a version numberassociated with a dynamic transaction card indicating the last versionof firmware and/or software that was pushed to the dynamic transactioncard. Upon reviewing the version of the firmware and or software storedon a dynamic transaction card associated with the authorization requestand/or communication, the issuer may determine that an update isrequired by comparing the version number to a most recent versionavailable.

Moreover, an issuer and/or firmware and/or software provider system maycompare the version of the firmware and/or software stored on a dynamictransaction card associated with the stored version of firmware and/orsoftware that was last pushed to the dynamic transaction card to confirmwhether the firmware and/or software version stored on the dynamictransaction card matches the expected firmware and/or software version(i.e., the last version of firmware and/or software that was pushed tothe dynamic transaction card). If an issuer and/or firmware and/orsoftware provider system determines that the received version indicatorfrom the dynamic transaction card does not match the stored versionrepresenting the last version pushed to the dynamic transaction card,the issuer and/or firmware and/or software provider system may triggeran alert, such as a fraud alert, which may in turn trigger dynamictransaction card activity (e.g., card deactivation, card hold, and/orthe like).

In an example embodiment, an issuer and/or firmware/software providersystem also may force an update to firmware and/or software regardlessof a current version of firmware and/or software stored on a dynamictransaction card. In this manner, a secure terminal may not need todetermine a current firmware and/or software version stored on a dynamictransaction card, but may require an on-line authorization and/oron-line communication to allow the issuer and/or firmware and/orsoftware provider to force an update to the dynamic transaction card.

Once an issuer system has determined that a firmware and/or softwareupdate is required for a dynamic transaction card, either via aninstruction from a secure terminal or via a comparison of a receivedversion to the most current version stored at the issuer system, theissuer system may create an authorization and/or communication responsemessage. A most current version stored at the issuer system may alsoinclude a rollback version (e.g., previous version). A rollback versionmay be tagged as the most current version stored at the issuer systemwhen, for example, a vulnerability or bug is found in a firmware and/orsoftware version and the issuer and/or firmware and/or software providersystem desires to replace firmware and/or software versions stored ondynamic transaction cards with known secure, bug-free versions. Arollback version may be tagged as the most current version stored at theissuer system when, for example, beta testing was used for a new versionand the issuer and/or firmware and/or software provider may desire toroll back a beta version to a previous version.

Once issuer system (e.g., firmware and/or software provider) has createdan authorization and/or communication response message, this responsemessage may be transmitted to the POS terminal/ATM/stand-alone secureterminal, for example, as illustrated in FIG. 5. At block 606, the POSterminal/ATM/stand-along secure terminal may transmit at least a portionof a firmware and/or software update via the secure connection from abackend system (e.g., a financial institution system and/or otherdynamic transaction card firmware and/or software provider system) tothe dynamic transaction card. As described above, a firmware and/orsoftware provider may include an issuer that may communicate with asecure terminal through an authorization or other network that is usedto authorize a transaction and/or communicate with the secure terminal.

A transmission of at least a portion of a firmware and/or softwareupdate may occur during and/or at the end of a transaction, such as anEMV transaction, via an authorization and/or communication responsemessage. The authorization and/or communication response message mayinclude data packets according to the ISO-8583 standard. For example,ISO-8583 may include a bitmap as an indexing technique to indicateadditional data elements that are present. These additional dataelements may include alphabetic characters, numeric values, specialcharacters, binary data, hex data, and/or the like.

The authorization and/or communication response message may include aportion of the updates firmware and/or software program, the entireupdated firmware and/or software program, a section of the updatedfirmware and/or software program, a cryptographic key to decrypt afirmware and/or software update, and/or a checksum associated with theupdated firmware and/or software program. At block 608, a decision maybe made as to the contents of the at least a portion of firmware and/orsoftware update received includes the entire firmware and/or softwareupdate. For example, an authorization and/or communication responsemessage may include an indicator alerting the dynamic transaction cardas to the contents of the authorization and/or communication responsemessage. An indicator may include a data structure that works withand/or is incorporated into an ISO-8583 communication. In this mannerthe indicator received in the authorization and/or communicationresponse may indicate that the received at least a portion of firmwareand/or software update includes a portion of the updates firmware and/orsoftware program, the entire updated firmware and/or software program, asection of the updated firmware and/or software program, a cryptographickey to decrypt a firmware and/or software update, and/or a checksumassociated with the updated firmware and/or software program. Thedynamic transaction card may be alerted as to the contents of theauthorization and/or communication response message via an associatedmobile device. For example, an issuer and/or firmware and/or softwareprovider system may transmit a notification to an associated mobiledevice that a firmware and/or software update (and/or a portion thereof)is pending on the dynamic transaction card. A mobile device may thennotify the dynamic transaction card that the received authorizationand/or communication response message includes a firmware and/orsoftware update (and/or portion thereof).

Where the at least a portion of a firmware and/or software updatedincluding the entire updated firmware and/or software program, abootloader on the dynamic transaction card may execute the update atblock 626. For example, a bootloader may receive a boot signal from adevice, such as a the secure terminal and/or a mobile device, use thebootloader signal to validate the bootloader and determine whether theexisting firmware and/or software is valid, load the updated firmwareand/or software program, and execute the updated firmware and/orsoftware program, which overwrites the existing firmware and/orsoftware.

If the at least a portion of the firmware and/or software update is notthe entire updated firmware and/or software program, the remainingportion of the firmware and/or software update may be downloaded from auser device, such as a smart phone, tablet, computer, and/or the like,via a network, such as a Bluetooth, Bluetooth Low Energy (BLE), NFC,WiFi, and/or other wireless network, in block 610. Where the at least aportion of the firmware and/or software update is not the entire updatedfirmware and/or software program, a notification may be received on thedynamic transaction card to alert and instruct the card holder toconnect to an associated mobile device and download the remaining updatefrom the mobile device via a network connection. Where the at least aportion of the firmware and/or software update is not the entire updatedfirmware and/or software program, a notification may be received on amobile device associated with a dynamic transaction card to alert andinstruct the card holder to connect to an associated mobile device anddownload the remaining update from the mobile device via a networkconnection.

At block 610, the remaining portion of the firmware and/or softwareupdate may be downloaded from a mobile device associated with thedynamic transaction card. This download may occur by connecting thedynamic transaction card to the mobile device. A connection between adynamic transaction card and a mobile device may include a physicalconnection, such as using a portable EMV reader attached to the userdevice, a mobile device that includes an electronic card reader, and/orthe like. A connection may include a contactless connection, such as aBluetooth or BLE connection as described in U.S. patent application Ser.No. 14/977,730 entitled “System, Method, and Apparatus for Locating aBluetooth Enabled Transaction Card,” the entire contents of which areincorporated by reference. A connection may include other contactlessconnections such as using a WiFi connection, an NFC connection, an RFIDconnection, and/or the like.

At block 612, the remaining update received from a firmware and/orsoftware provider via a mobile device may be stored within a dynamictransaction card. The update may be temporarily stored, for example, ina secure element, such as an EMV processor, in order to separate theupdate from additional elements of the dynamic transaction card andprevent any tampering. If necessary, the remaining update received via amobile device may be connected to the at least a portion of the updatereceived via a secure terminal using identifiers included in theremaining update received via a mobile device and the at least a portionof the update received via a secure terminal. In this manner, thedynamic transaction card may identify the received data as being part ofthe same, or identified, updated version. A version number (e.g., 2bytes of data) assigned to firmware and/or software stored on thedynamic transaction card may be transmitted to the secure terminal. Asecure terminal may store current firmware and/or software versionnumber data to compare a received version number with current versiondata to determine whether a firmware and/or software provider systemshould send firmware and/or software data within transaction datapackets.

Where a dynamic transaction card has multiple updates pending, thedynamic transaction card may transmit a query to an associated mobiledevice which then causes the associated mobile device to transmit aquery to an issuer and/or firmware/software provider system to retrievea checksum associated with the binary for the most current (or correct)update stored on the dynamic transaction card. This checksum may then betransmitted to the dynamic transaction card via a secure terminal and/oran associated mobile device. The dynamic transaction card may thencalculate a checksum associated with each pending update using, forexample, an EMV processor, and compare the calculated checksums with thereceived checksum. If the dynamic transaction card determines that acalculated checksum matches the received checksum, the dynamictransaction card may execute the update associated with the matchedcalculated checksum. The dynamic transaction card may also delete allpending updates that do not match the received checksum. Once eachreceived portion of the update is identified and/or validated asassociated with a particular update version, the entire contents of theupdate version may be stored together in, for example, a secure elementof the dynamic transaction card. (e.g., EMV processor).

At block 614, if any portion of the firmware and/or software updatedownloaded from a mobile device or secure terminal is encrypted, thedynamic transaction card may decrypt it. For example, the portion of thefirmware and/or software update received from the secure terminal mayinclude a key (e.g., a private key, a public key, and/or the like) todecrypt the remaining portion received from a user device. An EMVprocessor may also include pre-stored keys (e.g., private keys, publickeys, and/or the like) that may be used to decrypt the remaining portionof a firmware and/or software update received from a user device. Forexample, an EMV processor may include storage for cryptographic keys(e.g., public keys, private keys, and/or the like). Moreover, theremaining portion of the firmware and/or software update downloaded inblock 610 may include a cryptographic key, a key identifier, and/or thelike that may be used to decrypt and/or identify a pre-stored key thatmay be used to decrypt the remaining firmware and/or software update.

At block 616, if any portion of the firmware and/or software updatedownloaded from a mobile device in block 610 or the portion of thefirmware and/or software update received from the secure terminal inblock 606 includes a checksum associated with the firmware and/orsoftware update, this checksum may be used to verify the firmware and/orsoftware update. For example, a checksum may be calculated for the totalupdated firmware and/or software program received on the dynamictransaction card in block 616. In order to calculate checksums, an EMVprocessor may be used. For example, an EMV processor may be securedwithin a dynamic transaction card. An EMV processor may be a read-onlymicroprocessor. An EMV processor may include a cryptographiccoprocessor. An EMV processor may include a custom Applet to performchecksum calculations, compare calculated checksums, and/or determinedwhen to perform checksum calculations. An EMV processor may alsocommunicate via conductive plastic jumpers, such as the plastic jumpersdisclosed in U.S. Provisional Application No. 62/270,449, the entirecontents of which are incorporated herein. In this manner, if a dynamictransaction card were to be tampered with (e.g., using a solution totake apart the dynamic transaction card and reverse engineer ordetermine data stored within the electric transaction card), the data,including firmware and/or software update data, would remain securebecause the plastic jumpers would dissolve and no connection to the EMVprocessor would be available. Moreover, checksum validation as describedherein may occur for any firmware and/or software stored on a dynamictransaction card as disclosed in U.S. Provisional Application No.62/270,465, the entire contents of which are incorporated herein.

The received checksum may then be compared with the calculated checksumin block 618. In block 620, this comparison may verify that the totalupdate matches an expected update or may trigger an alert that theupdate does not match the expected update, thereby indicating that theupdate may include any additional malware, spyware, and/or the like.

If the received checksum is equal to the calculated checksum, theupdated firmware and/or software program may be considered validated inblock 624. If the received checksum is not equal to the calculatedchecksum, the dynamic transaction card may transmit an alert to anassociated mobile device and/or the firmware and/or software provider inblock 622. This alert may trigger a backend action such as adeactivation of the dynamic transaction card, a hold on the dynamictransaction card, the transmission of a message to a user device and/orthe dynamic transaction card (via the user device and/or a terminal),and/or logging the backend action in response to the alert.

Once an update is validated, a bootloader on the dynamic transactioncard may execute the updates firmware and/or software in block 626. Forexample, a bootloader on the dynamic transaction card may receive a bootsignal from a device, such as a the associated mobile device and/or asecure terminal, use the bootloader signal to validate the bootloaderand determine whether the existing firmware and/or software is valid,load the updated firmware and/or software program, and execute theupdated firmware and/or software program, which overwrites the existingfirmware and/or software.

A status of the update procedure may be logged on the dynamictransaction card, a user device (once the status is transmitted from thedynamic transaction card to the user device), and/or a backend systemvia a user device connection (e.g., financial institution,firmware/software provider system, and/or the like) in block 628. Atblock 630, the method may end.

Validation of firmware and/or software of an electronic device, such asdevice 120, card 200, and/or card 300, may occur using the method 700described in FIG. 7. For example, validation may start at block 702.

At block 704, an electronic device may receive a set of rules toinitiate checksum validation. These rules may be stored in block 706 ina secure element, such as a TPM and/or EMV chip acting as a TPM. A setof rules may include rules to determine when to perform checksumvalidation. For example, checksum validation may be time-driven and/orevent-driven. Where an electronic device is a dynamic transaction cardsuch as dynamic transaction card 120, 200, 300, events that may initiatechecksum validation of the firmware and/or software stored on thedynamic transaction card may include at each transaction, attransactions over a predefined threshold, upon powering up of thedynamic transaction card, upon waking of the dynamic transaction card,upon receiving a wireless transmission at a dynamic transaction card(e.g., via Bluetooth, BLE, RFID, NFC, and/or WiFi), upon request fromthe card holder, and/or upon request from the card issuer. Such as, forexample, as depicted in FIG. 8.

For example, FIG. 8, which illustrates an example device 810 with an EMVchip 812 as a TPM in order to store and calculate checksums for firmwareand/or application validation, may initiate checksum based on a numberof input received at device 810. As described above, checksumcalculation may be initiated upon receiving a wireless transmission at adynamic transaction card, such as a transmission received from a mobiledevice 820 over a network 830. This transmission may be received viaantenna 814. Data may be received and/or transmitted using, for examplean application that maintains and/or creates a secure connection with afirmware and/or software provider, such as a financial institution. Asdescribed above, checksum calculation may be initiated upon powering upor waking of the device 810 via, for example, a sensor 818, or uponinput via a sensor 818.

At block 708, checksums may be calculated for firmware and/or softwareon the electronic device. A checksum may be calculated using a number ofchecksum algorithms. These checksums may be calculated upon loading thefirmware and/or software. The firmware and/or software may be loaded bya firmware and/or software provider and/or an electronic devicemanufacturer.

At block 710, the checksums may be calculated and transmitted for eachsoftware program to be loaded onto a dynamic transaction card. Achecksum may be transmitted to the EMV chip and may be stored in asecure element (e.g., TPM, EMV chip, and/or the like as describedherein) of the electronic device as. In this manner, the checksums maynot be altered once the electronic device is released from the firmwareand; or software provider and/or device manufacturer. At block 712, theelectronic device may receive data triggering the stored rules toperform a checksum validation for the electronic device's firmwareand/or software. Trigger data may include a time if the rules stored inblock 706 indicate a time-based rule that initiates checksum validation.Trigger data may include a particular event as described above if therules stored in block 706 indicate an event-based rule that initiateschecksum validation.

Checksum validation may then begin in block 714 where memory includingthe firmware and/or software to be validated (e.g., memory⋅ external tothe secure element) is read by the secure element. By reading thememory, the secure element may determine memory data (e.g., bytes,words, and/or the like) associated with the memory. In block 716, thismemory data may be passed to a cryptographic coprocessor in the secureelement. A cryptographic coprocessor may then calculate a checksum forthe received memory data at block 718. A checksum may be calculated (inblock 718 and block 708) using a number of checksum algorithms. Forexample, a checksum may be calculating using a longitudinal paritycheck, a modular sum, Fletcher's checksum, Adler-32, cyclic redundancychecks, and/or the like.

At block 720 the calculated checksum may be compared to the storedchecksum in order to validate the firmware and/or software stored on theelectronic device. This comparison may take place using the secureelement. If the comparison indicates that the checksums match, thefirmware and/or software may be validated at block 722. This validationmay be stored as validation data within the secure element. Validationdata may also be transmitted to an external device and/or system, suchfirmware/software provider system 130, third party system 150, and/ormobile device 140.

If the checksums do not match, the secure element may instruct theelectronic device to take a corrective action and/or the secure elementmay execute a corrective action itself at block 724. A corrective actionmay include zeroing, wiping, or deactivating the electronic device.Zeroing, wiping, and/or deactivating a dynamic transaction card may beperformed via an erase script to erase the entire or a portion of thememory of card 200, a script to sever a connection, and/or the like. Acorrective action may include transmitting a notification to afirmware/software provider system, such as firmware/software providersystem 130, a mobile device associated with the dynamic transactioncard, such as mobile device 140, and/or a third party system (e.g.,merchant system, fraud alert system, and/or the like), such as thirdparty system 150. The method may end at block 726.

The present disclosure is not to be limited in terms of the particularembodiments described in this application, which are intended asillustrations of various aspects. Many modifications and variations canbe made without departing from its spirit and scope, as may be apparent.Functionally equivalent methods and apparatuses within the scope of thedisclosure, in addition to those enumerated herein, may be apparent fromthe foregoing representative descriptions. Such modifications andvariations are intended to fall within the scope of the appendedrepresentative claims. The present disclosure is to be limited only bythe terms of the appended representative claims, along with the fullscope of equivalents to which such representative claims are entitled.It is also to be understood that the terminology used herein is for thepurpose of describing particular embodiments only, and is not intendedto be limiting.

With respect to the use of substantially any plural and/or singularterms herein, those having skill in the art can translate from theplural to the singular and/or from the singular to the plural as isappropriate to the context and/or application. The varioussingular/plural permutations may be expressly set forth herein for sakeof clarity.

It may be understood by those within the art that, in general, termsused herein, and especially in the appended claims (e.g., bodies of theappended claims) are generally intended as “open” terms (e.g., the term“including” should be interpreted as “including but not limited to,” theterm “having” should be interpreted as “having at least,” the term“includes” should be interpreted as “includes but is not limited to,”etc.). It may be further understood by those within the art that if aspecific number of an introduced claim recitation is intended, such anintent may be explicitly recited in the claim, and in the absence ofsuch recitation no such intent is present. For example, as an aid tounderstanding, the following appended claims may contain usage of theintroductory phrases “at least one” and “one or more” to introduce claimrecitations. However, the use of such phrases should not be construed toimply that the introduction of a claim recitation by the indefinitearticles “a” or “an” limits any particular claim containing suchintroduced claim recitation to embodiments containing only one suchrecitation, even when the same claim includes the introductory phrases“one or more” or “at least one” and indefinite articles such as “a” or“an” (e.g., “a” and/or “an” should be interpreted to mean “at least one”or “one or more”); the same holds true for the use of definite articlesused to introduce claim recitations. In addition, even if a specificnumber of an introduced claim recitation is explicitly recited, suchrecitation should be interpreted to mean at least the recited number(e.g., the bare recitation of “two recitations,” without othermodifiers, means at least two recitations, or two or more recitations).Furthermore, in those instances where a convention analogous to “atleast one of A, B, and C, etc.” is used, in general such a constructionis intended in the sense one having skill in the art would understandthe convention (e.g., “a system having at least one of A, B, and C”would include but not be limited to systems that have A alone, B alone,C alone, A and B together, A and C together, B and C together, and/or A,B, and C together, etc.). In those instances where a conventionanalogous to “at least one of A, B, or C, etc.” is used, in general sucha construction is intended in the sense one having skill in the artwould understand the convention (e.g., “a system having at least one ofA, B, or C” would include but not be limited to systems that have Aalone, B alone, C alone, A and B together, A and C together, B and Ctogether, and/or A, B, and C together, etc.). It may be furtherunderstood by those within the art that virtually any disjunctive wordand/or phrase presenting two or more alternative terms, whether in thedescription, claims, or drawings, should be understood to contemplatethe possibilities of including one of the terms, either of the terms, orboth terms. For example, the phrase “A or B” may be understood toinclude the possibilities of “A” or “B” or “A and B.”

The foregoing description, along with its associated embodiments, hasbeen presented for purposes of illustration only. It is not exhaustiveand does not limit the invention to the precise form disclosed. Thoseskilled in the art may appreciate from the foregoing description thatmodifications and variations are possible in light of the aboveteachings or may be acquired from practicing the disclosed embodiments.For example, the steps described need not be performed in the samesequence discussed or with the same degree of separation. Likewise,various steps may be omitted, repeated, or combined, as necessary, toachieve the same or similar objectives. Accordingly, the invention isnot limited to the above-described embodiments, but instead is definedby the appended claims in light of their full scope of equivalents.

In the preceding specification, various preferred embodiments have beendescribed with references to the accompanying drawings. It may, however,be evident that various modifications and changes may be made thereto,and additional embodiments may be implemented, without departing fromthe broader scope of the invention as set forth in the claims thatfollow. The specification and drawings are accordingly to be regarded asan illustrative rather than restrictive sense.

What is claimed is:
 1. A method for validating a firmware program, themethod comprising: storing, in memory of a transaction card, thefirmware program; receiving, at a processor of the transaction card, oneor more rules to initiate a checksum validation via an applet; reading,via the applet, the firmware program stored on the transaction card;calculating, via a cryptographic processor of the transaction card, afirst checksum for the firmware program; receiving, at the processor,data triggering the one or more rules; reading, via a secure element,the memory including the firmware program to identify memory data inresponse to receiving the data triggering the one or more rules;transmitting, via the secure element, the memory data to thecryptographic processor; calculating, via the cryptographic processor, asecond checksum for the firmware program; comparing, using theprocessor, the first checksum and the second checksum to determine ifthe first checksum and the second checksum match; and either: validatingthe firmware program in response to determining that the first checksumand the second checksum match; or deleting at least a portion of data inthe memory in response to determining that the first checksum and thesecond checksum do not match.
 2. The method of claim 1, wherein: the oneor more rules comprise a first time-driven rule; and the data triggeringthe one or more rules comprises a time in which to read the memory toidentify the memory data.
 3. The method of claim 1, wherein: the one ormore rules comprise a first event-driven rule; and the data triggeringthe one or more rules comprises data indicating at least one of: a firstinitiation of a first transaction; a second initiation of a secondtransaction over a predefined monetary threshold; a waking of thetransaction card from a sleep mode; and a connection attempt, via anantenna, to an external device.
 4. The method of claim 3, wherein thedata triggering the one or more rules is received from a point of saledevice in communication with the processor.
 5. The method of claim 4,further comprising receiving power to power the processor from the pointof sale device.
 6. The method claim 5, wherein the waking of thetransaction card from the sleep mode is performed in response toreceiving the power from the point of sale device.
 7. The method ofclaim 4, further comprising connecting, via an antenna, to the point ofsale device via a contactless connection.
 8. The method of claim 1,further comprising storing the first checksum in the secure element suchthat the first checksum is protected from alteration once calculated. 9.The method of claim 1, further comprising receiving the firmware programvia a secure connection with a financial institution.
 10. A method forvalidating firmware programs, the method comprising: storing, in asecure element of a transaction card, an existing firmware program forthe transaction card; storing, in the secure element, a first checksumcalculated using the existing firmware program upon loading of theexisting firmware program; receiving, at an input/output interface, anupdated firmware program from a firmware provider system; receiving, ata processor, a trigger that triggers checksum validation; reading, viathe processor, the secure element to identify the first checksum;calculating, via the processor, a second checksum for the updatedfirmware program; comparing, via the processor, the first checksum andthe second checksum to determine if the first checksum and the secondchecksum match; and either: executing the updated firmware program inresponse to determining that the first checksum and the second checksummatch; or triggering an alert in response to determining that the firstchecksum and the second checksum do not match.
 11. The method of claim10, wherein the updated firmware program is received from the firmwareprovider system during and/or at an end of a card transaction.
 12. Themethod of claim 10, wherein the updated firmware program is receivedfrom a point of sale device in communication with the processor.
 13. Themethod of claim 12, further comprising receiving power to power theprocessor from the point of sale device.
 14. The method claim 13,further comprising waking, via the processor, the transaction card inresponse to receiving the power from the point of sale device.
 15. Themethod of claim 12, further comprising connecting, via an antenna, tothe point of sale device via a contactless connection.
 16. The method ofclaim 10, wherein the alert causes the processor to execute an erasescript to erase at least a portion of data in the secure element and/ordeactivate the transaction card.
 17. The method of claim 10, wherein thealert causes the processor to communicate with a financial institutionto place a hold on an account associated with the transaction card. 18.The method of claim 10, wherein the alert causes the processor totransmit, via an antenna, a message to a paired user device.
 19. Themethod of claim 10, wherein the updated firmware program is encryptedand comprises a first cryptographic key; the method further comprising:storing, in the secure element, a second cryptographic key; anddecrypting, via the processor, the updated firmware program using thesecond cryptographic key and the first cryptographic key.
 20. The methodof claim 10, further comprising receiving power to power the processorfrom a point of sale device.